See How is Mono magical? for more background. /proc/sys/fs/binfmt_misc
is a virtual file system managed by binfmt_misc
(which is why the files are all 0-sized).
cli
is used for Windows and .NET executables (and really any MZ executable, as also used in DOS and OS/2); the detector it refers to determines whether a given binary should be run using Wine or Mono.
jar
provides support for JAR files, as used by Java programs. You can thus make a JAR executable, and run it directly (instead of using java -jar ...
).
The python
files provide support for Python bytecode.
status
shows the overall status of binfmt_misc
: in this case, it’s enabled.
register
allows new formats to be registered. This is done by echoing a string in a specific format (see the documentation for details) to register
. The registered format will show up as a new file alongside cli
, jar
and the others.
Many kinds of executable formats can be registered using binfmt_misc
. They can be matched using a file extension (.jar
etc., although JAR files are identified by their “PK” signature instead) or a magic value (“MZ” etc.), as long as the magic value occurs within the first 128 bytes. Beyond the files you’ve listed, other formats typically handled in this way are binaries for other architectures (“interpreted” by QEMU, or emulators such as Hatari), some interpreted game formats (the love
game engine registers itself in this fashion under Debian at least)...
Under Debian and derivatives, packages register binary formats using binfmt-support
and files in /usr/share/binfmts/cli
; dlocate -S /usr/share/binfmts/*
will tell you which packages are adding binary formats.
ELF doesn’t need any registration, it’s supported natively by the kernel.
It seems this has something to do with Position Independent Executable (PIE). When GCC compiles executable by defaults it makes them PIE which changes the output flag on the ELF Header to ET_DYN
.
You can disable the generation of PIE executables with
If you're seeing this check the default options gcc is configured with gcc -v
, you should see something like --enable-default-pie
.
Answer inspired by this submission on StackOverflow. I intend to play more with it and explain more here.
Best Answer
Core dumps are also object files, of a sort, and usually in ELF format, too. Running this program will probably produce a file named "core":
My
file
command says: